AyeCode Ltd
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Payment forms, Buy now buttons, and Invoicing System | GetPaid | 3 | – | Nov 4, 2026 |
| UsersWP | 3 | – | Nov 1, 2024 |
| Location Manager | 2 | – | Sep 18, 2026 |
| API KEY for Google Maps | 1 | – | Jun 15, 2022 |
| GeoDirectory | 1 | – | Aug 18, 2024 |
| WordPress Payments Plugin | GetPaid | 1 | – | Jun 21, 2021 |
Exploited and recent CVEs
- CVE-2026-119749 GetPaid WordPress Plugin < 2.8.63 Negative Quantity Payment Bypass 0.4%
- CVE-2026-119748 GetPaid WordPress Plugin < 2.8.63 Authorization Bypass via maybe_use_invoice 0.2%
- CVE-2026-119747 GetPaid WordPress Plugin < 2.8.63 Incorrect Authorization via REST API 0.2%
- CVE-2026-85705 Location Manager <= 2.3.38 - Unauthenticated SQL Injection via 'latitude' and 'longitude' REST API Parameters 0.5%
- CVE-2024-43277 WordPress UsersWP plugin <= 1.2.15 - Broken Access Control vulnerability 0.4%
- CVE-2024-43145 WordPress GeoDirectory plugin <= 2.3.61 - SQL Injection vulnerability 0.4%
- CVE-2024-31936 WordPress UsersWP plugin < 1.2.6 - Cross Site Request Forgery (CSRF) vulnerability 0.2%
- CVE-2022-47442 WordPress UsersWP Plugin <= 1.2.3.9 is vulnerable to CSV Injection 0.7%
- CVE-2022-29453 WordPress API KEY for Google Maps plugin <= 1.2.1 - CSRF vulnerability leading to Google Maps API key update 0.4%
- CVE-2021-24369 GetPaid < 2.3.4 - Authenticated Stored XSS 0.6%
- CVE-2021-24361 GeoDirectory Location Manager < 2.1.0.10 - Multiple Unauthenticated SQL Injections 1.8%